litesaml/lightsaml

Security

• Reject Responses with duplicate assertion IDs (#114)
• Reject assertions with missing or empty ID (#117) (#118)

Bug Fixes

• Throw LightSamlBindingException instead of TypeError in getBindingByRequest() (#116)

Full Changelog: 5.0.1...5.1.0

Security

• Reject Responses with duplicate assertion IDs (#114)
• Reject assertions with missing or empty ID (#117) (#118)

Bug Fixes

• Throw LightSamlBindingException instead of TypeError in getBindingByRequest() (#116)

Security

• Reject XML Signature Wrapping (XSW) attacks in SignatureXmlReader (#113)

LightSAML 5.0.0 was vulnerable to an XML Signature Wrapping (XSW) attack
allowing an attacker who has captured one genuine signed assertion to have
LightSAML accept a fully attacker-authored assertion as IdP-signed, leading
to authentication bypass and privilege escalation.

The fix enforces two invariants before signature validation: the ds:Signature
parent element must carry the ID referenced by the fragment URI, and that ID
must be unique in the document.

Full Changelog: 5.0.0...5.0.1

Security

• Reject XML Signature Wrapping (XSW) attacks in SignatureXmlReader (#113)

Breaking Changes

• Remove Pimple bridge and unused implementations (#107)
• Replace symfony/http-foundation with PSR-7 interfaces (#109)
• Bump minimum PHP requirement to 8.4
• Add strong typing to method parameters and return values (#110)
• Remove deprecated Serializable interface from state classes (#111)
• Enforce strict typing and reach PHPStan level 6 zero errors (#112)

Continuous Integrations

• Modernize CI workflows

Documentation

• Recommend litesaml/saml wrapper for high-level usage

Full Changelog: 4.7.0...5.0.0

Breaking Changes

• Remove Pimple bridge and unused implementations (#107)
• Replace symfony/http-foundation with PSR-7 interfaces (#109)
• Bump minimum PHP requirement to 8.4
• Add strong typing to method parameters and return values (#110)
• Remove deprecated Serializable interface from state classes (#111)
• Enforce strict typing and reach PHPStan level 6 zero errors (#112)

Continuous Integrations

• Modernize CI workflows

Documentation

• Recommend litesaml/saml wrapper for high-level usage

Features

• Add RSA-PSS certificate and SAML signature support (#102)
• Include AssertionConsumerServiceURL in outbound AuthnRequest (#103)
• Return SamlMessage from binding receive() method (#105)

Bug Fixes

• Bump dependencies to address security vulnerabilities (#101)
• Use SHA256 as default signing algorithm instead of SHA1 (#104)
• Use SignatureXmlReader instead of abstract Signature in RoleDescriptor deserialization (#106)

Full Changelog: 4.6.1...4.7.0

Features

• Add RSA-PSS certificate and SAML signature support (#102)
• Include AssertionConsumerServiceURL in outbound AuthnRequest (#103)
• Return SamlMessage from binding receive() method (#105)

Bug Fixes

• Bump dependencies to address security vulnerabilities (#101)
• Use SHA256 as default signing algorithm instead of SHA1 (#104)
• Use SignatureXmlReader instead of abstract Signature in RoleDescriptor deserialization (#106)

Bug Fixes

• Update robrichards/xmlseclibs to 3.1.4

Bug Fixes

• RoleDescriptor::getAllKeyDescriptorsByUse() dont fail on null keyDescriptors (#91)

Styles

• Use PHP CS Fixer as linter (#87)

Features

• Can handle compressed or uncompressed post request

Code Refactoring

• Remove monolog/monolog dependency (#82)
• Remove Symfony dom-crawler & css-selector dependency (#84)
• Remove php-conventional-changelog dependency

Tests

• Remove LightSaml prefix

Bug Fixes

• Helper::validateWellFormedUriString() return false on null

Code Refactoring

• Mark Pimple Bridge classes as deprecated

Bug Fixes

• Can use Symfony v7+

Code Refactoring

• Minimum requirement PHP 8.1 (#76)
• Use Schema::validate in XsdValidator (#77)

Bug Fixes

• Helper validateNotBefore return true when is on or after notBefore (#56)

Documentation

• Change cookbook URL

Bug Fixes

• Remove implicitly nullable parameter declarations (#75)

Features

• Supports Symfony 7.x

Bug Fixes

• Static analysis requirements
• Always use random_bytes() in Helper::generateRandomBytes()

Code Refactoring

• Use bin2hex() in Helper::stringToHex()

Continuous Integrations

• Recover tests (#55)

Bug Fixes

• Php 8.1 deprecation notices

Continuous Integrations

• Prevent running test on changelog update
• Prevent looping

Documentation

• Clean changelog

Documentation

• Update document URL
• Clean changelog

Bug Fixes

• Authenticate Github action user on workflow
• Add deprecation to usage of Serializable interface

Continuous Integrations

• Add authentication on push action

Code Refactoring

• Compliant with Symfony 6 session recommendations

Features

• Allow Symfony 6 and Monolog 3

Documentation

• Change documentation URL

Continuous Integrations

• Add script in composer for test, phpcs & phpstan use in CI

Code Refactoring

• Remove .changelog and README.md from export
• Remove Makefile.

Code Refactoring

• Development files won’t be added to git archive

Documentation

• Move assets to .github directory

Code Refactoring

• Introduce PSR-4 autoloading

Documentation

• Add LICENSE document.

Continuous Integrations

• Automatic update of CHANGELOG on commit on master

Documentation

• Preparing CHANGELOG for automation

• Change package name in banner
• Add PHPStan to CI
• Clean code with PHPStan
• Clean code by removing unnecessary backslash

• Replace symfony/event-dispatcher dependency by psr/event-dispatcher

• Change package description

• Fix composer documentation settings

• Fix Documentation

• Move doc in dedicated repository
• Move resources files for tests in tests directory
• Drop deprecated files
• Move schemas in dedicated package
• Update composer metadata
• Update Readme

• Fix LightSaml\Model\XmlDSig\SignatureXmlReader::validate() exception catching

• Fix return types in LightSaml\Context\AbstractContext & LightSaml\Meta\ParameterBag

• Fix param types in LightSaml\Model\Assertion\Conditions class

• Fix input id in SamlPostResponse

• Update to symfony packages 6.0

• Run tests by GitHub's actions

• Update PHPUnit 8.4+

• Clean code with php-cs-fixer

• PHP 7.2+ & Symfony 5